Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking to implement log tracking at my current company. After some research it seems Nagios and Splunk are the two best options. I was wondering if there is a consensus with which is better.

I understand that Splunk can be quite pricey if the non-free version is used. That being said I can imagine the answer to my question will be "If you have the money use Splunk, if not use Nagios"


locked by womble Sep 20 '15 at 2:43

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by womble Sep 20 '15 at 2:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Do you mean "Nagios Log Server" vs Splunk? – Jason Caldwell Jul 9 '15 at 15:29
up vote 14 down vote accepted

These are two different things so it's not an either or situation.

Splunk is to centralize and analyze your logs. It is capable of generating alerts so I can see how this functionality can be confused with Nagios. But Nagios is an infrastructure and services monitoring and alerting solution. It can monitor things that don't necessarily have logs like cpu usage, number of processes, even check for ssl certificates about to expire. Logs may not tell you that apache has stopped responding to http requests where Nagios can.

So in most situations you'll want to have something that does each of these jobs. For log correlation and analysis there aren't a lot of open source options but Octopussy looks pretty good. For infrastructure monitoring, alerts, and escalations there are a number of solutions out there. Both commercial and free/opensource.

Does that mean these two can/should be used in concert? – dan_vitch Apr 20 '10 at 21:36
At the end of the day it depends on what you're trying to accomplish. Both are good to have in any environment and both become more important as the environment gets larger and more complex. Also just to throw this out there there's a third type of tool for dealing with RRD graphs which are used for trending. Nagios is starting to do more of this natively and through plugins but the best known tool for this in the open source world is Cacti. – 3dinfluence Apr 20 '10 at 21:55
Thanks for the assistance – dan_vitch Apr 20 '10 at 22:24
You really should be using two tools - Nagios for SNMP and LogZilla for the syslog solution which is about 1/10 of the cost of Splunk. Also, +1 for Cacti - awesome tool! – Clayton Dukes Sep 4 '12 at 15:05
@dan_vitch the two can indeed be using in concert; I currently use both nagios and splunk; nagios to monitor services and availability, etc, and splunk to graph contents of logs (eg number of users picking up licenses for certain software packages from network license servers over time, etc). I also use cacti, which I'd recommend too - but only on my personal kit! – BE77Y Dec 17 '14 at 16:45

Nagios and Splunk are two completely different products. Nagios is more networking monitoring while Splunk is more of a log console and a place to correlate events from multiple sources (including Nagios). We use Nagios for monitoring and the free version of Splunk to consolidate syslog messages from all servers,network devices, and IPS equipment to one central location


Not the answer you're looking for? Browse other questions tagged or ask your own question.